Module evaluators 

Test-only PolicyEvaluator implementations.

[DenyAllEvaluator] and [PermitAllEvaluator] let downstream crates write unit tests without building a real policy document or parser. Gated on the test-utils feature.